> Lennart Poettering <mzxreary@0pointer.de> writes:> > > On Thu, 04.03.10 15:08, Oleg Nesterov (oleg@redhat.com) wrote:> >> >> Should we clear ->child_anchor flags when the "sub-init" execs? Or,> >> at least, when the task changes its credentials? Probably not, but> >> dunno.> >> > Since this flag is only useful for a very well defined type of processes> > (i.e. session managers, supervising daemons, init systems) it might make> > sense to reset it automatically when privs are dropped or we exec> > something. After all, I don't see how we'd gain any useful functionality> > when we allow this flag to continue to be set. However we would> > certainly be on the safer side when we reset it, because that way it can> > never leak it to processes that are differently privileged or do not> > expect it.> >> > So, for the sake of being on the safe side, I think we should reset the> > flag on exec()/setuid().> >> >> It is a bit strange that PR_SET_ANCHOR acts per-thread, not per> >> process.> >> > Yes, I agree, this should be per-process indeed.> > Have you take a look at the pid namespace?> > Except for the fact it requires privilege to create it seems to do> what you want. It is certainly what I have been using when I want> an inescapable environment.> > If nothing else I get the feeling that what you are after is> a generalization of the child_reaper feature in the pid namespace> and yet you haven't touched any of that code.

I guess it doesn't fit for gnome-session. because gtop or similarsystem monitoring process assume it can see all processes in the system.